So Microsoft just quietly patched something that I think deserves more attention in the enterprise security community.

Silverfort's researchers (Noa Ariel and Yoav S.) discovered that the Agent ID Administrator role in Microsoft Entra ID — introduced specifically to manage AI agent identities — had a scope overreach flaw. Despite being documented as "scoped to agent-related objects only," the role could:

• Assign ownership of any service principal in the tenant (not just agent-related ones)

• Inject credentials onto that principal

• Authenticate as that principal → inherit all its permissions

If the targeted service principal had Global Admin or privileged Graph API permissions? Full tenant compromise from a role that looks like a low-privilege bot management assignment.

The fix was deployed server-side by Microsoft on April 9, 2026. No customer action needed.…